Patch for pluto

Hi,

Attached you will find a small patch for the pluto service script.

It fixes the UNKNOWN entries of this kind:
UNKNOWN: Oct  7 00:10:28 phv003 pluto[1969]: "localconn"[4] xxx.xxx.xxx.xxx 
#2525: crl update is overdue since Sep 28 07:06:32 UTC 2008

With the patch, these lines will be parsed, and the output will contain one 
additional line per connection:

   Peer localconn caused 197 lines of output.
        connected from:xxx.xxx.xxx.xxx
        Keyed: 31 successes 0 failures (max retries: 0)
        IPsec SAs: 3
->      Overdue CRL update since: Sep 28 07:06:32 UTC 2008 (62 times)


I hope this is useful for others as well.

Regards,

Geert
-- 
Kobalt W.I.T.
Web & Information Technology
Brusselsesteenweg 152
1850 Grimbergen

Tel  : +32 479 339 655
Email: [email protected]

_______________________________________________
Logwatch-Devel mailing list
[email protected]
http://www2.list.logwatch.org:81/mailman/listinfo/logwatch-devel

Index: pluto
===================================================================
RCS file: /var/cvs/logwatch/scripts/services/pluto,v
retrieving revision 1.17
diff -u -r1.17 pluto
--- pluto	30 Jun 2008 23:07:51 -0000	1.17
+++ pluto	10 Oct 2008 08:38:01 -0000
@@ -184,6 +184,12 @@
       $rekeyfail{$conn}++;
       $rekeyfail_notknown{$1}++;
 
+   } elsif($rest =~ /crl update is overdue since (.*)/) {
+
+      $crlUpdate{$conn}++;
+      $crlUpdateSince{$conn} = $1;
+      next;
+
    } elsif($rest =~ /max number of retransmissions \((.*)\) reached STATE_QUICK_I./) {
 
       $rekeyfail{$conn}++;
@@ -263,6 +269,9 @@
       if($setupfail{$conn} > 0) {
          print "\tSetup failures: ".$setupfail{$conn}."\n";
       }
+      if($crlUpdate{$conn} > 0) {
+         print "\tOverdue CRL update since: ".$crlUpdateSince{$conn}." (".$crlUpdate{$conn}." times)\n";
+      }
    }
 }